CVE-2022-31031: Potential stack buffer overflow when parsing message as a STUN client
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using pjlib-util/stunsimple API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-31031?
CVE-2022-31031 is a stack buffer overflow vulnerability in PJSIP that affects users using STUN in their application.
What is the severity of CVE-2022-31031?
The severity of CVE-2022-31031 is critical with a CVSS score of 9.8.
How does CVE-2022-31031 affect Teluu Pjsip?
CVE-2022-31031 affects Teluu Pjsip versions up to and including 2.12.1.
How does CVE-2022-31031 affect Debian Debian Linux 10.0?
CVE-2022-31031 affects Debian Debian Linux 10.0.
How does CVE-2022-31031 affect Debian Debian Linux 11.0?
CVE-2022-31031 affects Debian Debian Linux 11.0.
How do I fix CVE-2022-31031 in Teluu Pjsip?
To fix CVE-2022-31031 in Teluu Pjsip, update to a version higher than 2.12.1.
How do I fix CVE-2022-31031 in Debian Debian Linux 10.0?
To fix CVE-2022-31031 in Debian Debian Linux 10.0, apply the security patch with the version 1:16.28.0~dfsg-0+deb10u3 or higher.
How do I fix CVE-2022-31031 in Debian Debian Linux 11.0?
To fix CVE-2022-31031 in Debian Debian Linux 11.0, apply the security patch with the version 1:16.28.0~dfsg-0+deb11u3 or higher.
What are the Common Weakness Enumerations (CWE) associated with CVE-2022-31031?
The Common Weakness Enumerations (CWE) associated with CVE-2022-31031 are CWE-119, CWE-120, and CWE-787.